Procedure examples

Exaramel for Windows specifies a path to store files scheduled for exfiltration.

NOKKI can collect data from the victim and stage it in LOCALAPPDATA%\MicroSoft Updatea\uplog.tmp.

KOPILUWAK has piped the results from executed C2 commands to `%TEMP%\result2.dat` on the local machine.

VersaMem staged captured credentials locally at `/tmp/.temp.data`.

PAKLOG has stored the captured data in a file located `C:\\Users\\Public\\Libraries\\record.txt`.

Ursnif has used tmp files to stage gathered information.

FrameworkPOS can identifiy payment card track data on the victim and copy it to a local file in a subdirectory of C:\Windows\.

InvisibleFerret has staged data in consolidated folders prior to exfiltration.

RainyDay can use a file exfiltration tool to copy files to C:\ProgramData\Adobe\temp prior to exfiltration.

AppleSeed can stage files in a central location prior to exfiltration.

NETWIRE has the ability to write collected data to a file created in the ./LOGS directory.

MirrorStealer has stored stolen credentials on the local machine in `%TEMP%\31558.txt`.

Turian can store copied files in a specific directory prior to exfiltration.

Machete stores files and logs in a folder on the local drive.

PowerLess can stage stolen browser data in `C:\\Windows\\Temp\\cup.tmp` and keylogger data in `C:\\Windows\\Temp\\Report.06E17A5A-7325-4325-8E5D-E172EBA7FC5BK`.

Prikormka creates a directory, %USERPROFILE%\AppData\Local\SKC\, which is used to store collected log files.

Mafalda can place retrieved files into a destination directory.

AuTo Stealer can store collected data from an infected host to a file named `Hostname_UserName.txt` prior to exfiltration.

SombRAT can store harvested data in a custom database under the %TEMP% directory.

FLASHFLOOD stages data it copies from the local system or removable drives in the "%WINDIR%\$NtUninstallKB885884$\" directory.

LoFiSe can save files to be evaluated for further exfiltration in the `C:\Programdata\Microsoft\` and `C:\windows\temp\` folders.

Cuckoo Stealer has staged collected application data from Safari, Notes, and Keychain to `/var/folder`.

InvisiMole determines a working directory where it stores all the gathered data about the compromised machine.

MarkiRAT can store collected data locally in a created .nfo file.

Kazuar stages command output and collected data in files before exfiltration.

NavRAT writes multiple outputs to a TMP file using the >> method.

CHIMNEYSWEEP can store captured screenshots to disk including to a covert store named `APPX.%x%x%x%x%x.tmp` where `%x` is a random value.

Chrommme can store captured system information locally prior to exfiltration.

ObliqueRAT can copy specific files, webcam captures, and screenshots to local directories.

SocGholish can send output from `whoami` to a local temp file using the naming convention `rad<5-hex-chars>.tmp`.

PUNCHBUGGY has saved information to a random temp file before exfil.

Pteranodon creates various subdirectories under %Temp%\reports\% and copies files to those subdirectories. It also creates a folder at C:\Users\<Username>\AppData\Roaming\Microsoft\store to store screenshot JPEG files.

BeaverTail has staged collected data to the system’s temporary directory.

DarkWatchman can stage local data in the Windows Registry.

Dyre has the ability to create files in a TEMP folder to act as a database to store information.

PACEMAKER has written extracted data to `tmp/dsserver-check.statementcounters`.

PlugX has collected and staged the victim’s computer files for exfiltration.

Lumma Stealer has configured a custom user data directory such as a folder within `%USERPROFILE%\AppData\Roaming` for staging data.

DustySky created folders in temp directories to host collected files before exfiltration.

Rover copies files from removable drives to C:\system.

LightNeuron can store email data in files and directories specified in its configuration, such as C:\Windows\ServiceProfiles\NetworkService\appdata\Local\Temp\.

Elise creates a file in AppData\Local\Microsoft\Windows\Explorer and stores all harvested data in that file.

LODEINFO has collected stolen web cookies locally in the `%TEMP%` folder.

Sagerunex gathers host information and stages it locally as a RAR file prior to exfiltration. Sagerunex stores logged data in an encrypted file located at `%TEMP%/TS_FB56.tmp` during execution.

LP-Notes has stored collected credentials in ` C:\Users\Public\Downloads\lp-notes.txt`.

GlassWorm has staged collected data in a working directory within a temp folder to include `/tmp/ijewf`.

Trojan.Karagany can create directories to store plugin output and stage data for exfiltration.

SPACESHIP identifies files with certain extensions and copies them to a directory in the user's profile.

KGH_SPY can save collected system information to a file named "info" before exfiltration.

Catchamas stores the gathered data from the machine in .db files and .bmp files under four separate locations.